1

I am running Bitcoin Core version v0.19.0.1 (64-bit) on Windows 7, and on 27 February I noticed that it sent 0.0045 bitcoins on its own.

The wallet is encrypted at all times and I enter the passphrase to send as required.

I did NOT initiate the Send.

I am greatly concerned. The PC is regularly checked for virus and malware.

The transaction details are:-

Status: 320 confirmations Date: 27/02/2020 16:37 To: bc1qz944eascuflps4nmsc0w5cpz9p3cxdyqjmmqw7 Debit: -0.00447194 BTC Transaction fee: -0.00002806 BTC Net amount: -0.00450000 BTC Transaction ID: 3c138afea7d634ce5e8b608e1a751122d6d33ba9bd8e00a02de02cb57aad039d Transaction total size: 214 bytes Transaction virtual size: 133 bytes Output index: 0

The previous transaction:-

Status: 455 confirmations Date: 26/02/2020 18:27 From: unknown To: 3Hb61TTkbxPTUCA6EvUStb8PPMZUjPASfd (own address, label: coinfloor) Credit: x.xxxxxxxx BTC Net amount: +x.xxxxxxxx BTC Transaction ID: 5697d9b298647c216a727f95dbdecfc658a9f8da3c45f98bc8c8a2439c8f1cfc Transaction total size: 404 bytes Transaction virtual size: 214 bytes Output index: 1

The last time I sent was with this:-

Status: 43126 confirmations Date: 17/05/2019 07:25 To: Coinfloor 5 10 13vk63282b4FkhyyV9mmgQTxpao9ECnnmB Debit: -x.xxxxxxxx BTC Transaction fee: -x.xxxxxxxx BTC Net amount: -x.xxxxxxxx BTC Transaction ID: d23b6c3f42339ace670d0ebdca4eabcfe45c34b0ccab44c9767a519682e415ba Transaction total size: 932 bytes Transaction virtual size: 530 bytes Output index: 1

I would like to know how this could have happened, because I definitely did NOT initiate this send.

Any suggestions about how to diagnose this? I expect there's no way to recover the 0.0045 coins.

Improve this question
14
  • Check if it is really Bitcoin Core. Check if you really don't have Trojan horse.
    – CoperNick
    Mar 1, 2020 at 12:21
  • When was the last time when you enter the password on your PC for your wallet?
    – CoperNick
    Mar 1, 2020 at 12:33
  • Didn't you reveal priv key to one of your addresses? Looks like BTC from only one address was sent. BTC from other addresses were not stolen.
    – CoperNick
    Mar 1, 2020 at 13:01
  • I last used my passphrase on 17th May 2019.
    – Sal P
    Mar 1, 2020 at 14:50
  • So, there was more than 0.0045 in my wallet. Why was a larger amount not taken?
    – Sal P
    Mar 1, 2020 at 14:51

1 Answer 1

Reset to default
1

You do not explain why you believe your bitcoin core process sent the bitcoins. It is perfectly possible (from looking at your logs) that it was not sent from your bitcoin core, but from elsewhere on the bitcoin network. It may be possible to track down where the tx was sent from if enough nodes log the IP address of where the transaction was initiated, but there is nothing in your logs to suggest it was initiated from your node. In fact, your logs suggest that it was not initiated from your node.

Therefore, at some point the private keys for your bitcoin address were obtained. This could have been done if your computer contains malware, perhaps a key-logger, which was able to capture your wallet password, in combination with the wallet file.

The output that was spent was populated on 2018-12-28 19:12, but the private key associated with the address could have been created years earlier, as Bitcoin Core by default creates 100 addresses when it is first started, so the private key to this address could have been stored on a computer of yours for some time, perhaps even in an wallet with no password, if you initially didn't enable the password until later. So the time of intercept (of the private key) is theoretically any time between when you first ran Bitcoin Core and when the theft occurred.

Improve this answer
6
  • The reason I am convinced that the bitcoin core process sent the bitcoin is because bitcoin core was running at the time. I quite often just run it because I read that it's good practice. I noticed a message pop up on the screen that it had sent the bitcoins. I saw it with my own eyes! To say I was shocked is an understatement! I shut down bitcoin core, and removed the wallet.dat file. After re-running virus and malware checks, I re-booted the PC
    – Sal P
    Mar 1, 2020 at 19:50
  • I transferred the balance of my wallet to an exchange, to guard against any more leaks from my wallet. So, I could start again with a new download of bitcoin core, and a thorough virus check. Would that be enough, or should I buy a hardware wallet?,
    – Sal P
    Mar 1, 2020 at 20:02
  • My first use of bitcoin core was in 2013, and I believe I never used bitcoin core unencrypted
    – Sal P
    Mar 1, 2020 at 20:08
  • 1
    @SalP: What you describe actually doesn't prove that Bitcoin Core sent the coins. If I remember correctly, I believe the same popup will appear when Bitcoin Core notices a transaction broadcast on the network that spends your coins. The precautions you took are sensible, but even so, what you describe is also consistent with someone having obtained your private keys some other way, and spending them from a completely different node.
    – Nate Eldredge
    Apr 1, 2020 at 0:46
  • @SalP indeed - when you run bitcoin core, it has to download the blocks to catch up with the blockchain. When it downloaded the block containing the transaction you're referring to, it would notify you at that point. The point of download, not necessarily the point in time that the transaction was broadcast to the network.
    – Rebroad
    Apr 1, 2020 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.